diff --git a/backend/src/main.rs b/backend/src/main.rs
index 810cdfd..d153008 100644
--- a/backend/src/main.rs
+++ b/backend/src/main.rs
@@ -75,6 +75,7 @@ impl MyApp {
 
         // Reading thumbnail of a file
         if params.contains_key("thumb") {
+            if !path.is_file() { return "Error: File not found".to_string().resp(404) }
             return match self.generator.get_thumb(&PathBuf::from(path.to_owned())) {
                 Ok(vec) => { vec.resp(200) }
                 Err(e) => { e.to_string().resp(500) }
diff --git a/backend/src/thumbnailer.rs b/backend/src/thumbnailer.rs
index 2c31467..b016df8 100644
--- a/backend/src/thumbnailer.rs
+++ b/backend/src/thumbnailer.rs
@@ -47,8 +47,8 @@ impl Thumbnailer {
     pub fn gen(&self, orig: &str, new: &str, pixels: i32) -> Result<()> {
         let cmd = self.exec
             .replace("%s", &*format!("'{pixels}'"))
-            .replace("%u", &*format!("'{orig}'"))
-            .replace("%o", &*format!("'{new}'"));
+            .replace("%u", &shlex::quote(orig))
+            .replace("%o", &shlex::quote(new));
         let args: Vec<String> = Shlex::new(&*cmd).collect();
         let out = Command::new(args[0].to_owned()).args(&args[1..]).output()?;
         if !out.status.success() {